JP2016085341A - Round function calculation device and encryption device, method thereof and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a round function calculation technique and encryption technique having a circuit sharing function and having a processing load smaller than that of ANUBIS.SOLUTION: A first calculation unit 1 calculates SubBytes function for substituting respective elements of an input matrix of 4 rows and 4 columns using a predetermined substitution table with an involution property. A second calculation unit 2 calculates SwapRows function defined as the following formula for the output of the first unit 1. A third calculation unit 3 calculates MixColumns function for multiplying a predetermined agitation matrix of 4 rows and 4 columns with the involution property for the output of the second calculation unit 2. A fourth calculation unit 4 calculates AddRoundKey function for calculating an exclusive logic with a predetermined sub key matrix of 4 rows and 4 columns for the output of the third calculation unit 3.SELECTED DRAWING: Figure 1

Description

  The present invention relates to encryption used in the information security field.

  An encryption technique is effective for concealing data. Encryption methods include common key encryption and public key encryption. In the common key encryption, the same key is used on the encryption creation side and the encryption / decryption side, and this key is secretly managed. On the other hand, in public key cryptography, the key for ciphertext creation and the key for ciphertext decryption are different, and it is widely believed that even if one key is made public, the other key cannot be obtained within a realistic time. Yes. In general, from the viewpoint of the processing speed of encryption, a common key cryptosystem is advantageous, and common key cryptography is used in many environments on the Internet.

  In order to construct a high-speed and secure common key cipher, a method of dividing data to be encrypted into blocks of an appropriate length and encrypting each block is called a block cipher. In the block cipher, an encryption device that can be processed at a very high speed is prepared at first, although it is not sufficient as an encryption device called a round function. Next, the block function encryption device is obtained by repeatedly executing the round function a plurality of times. A typical example of such encryption is AES encryption. AES is an encryption device that uses a 4x4 matrix with 8 bits for each element as one block. The round function consists of the following four functions.

  SubBytes: Replaces the value of each cell with another value using a substitution table called S-box.

  ShiftRows: Rotate each row of 4x4 matrix by row number.

  MixColumns: Stir each column of the 4x4 matrix with a stirrer.

  AddRoundKey: Exclusively ORs the subkeys expressed in a 4x4 matrix.

  AES is defined as an American standard by the National Institute of Standards and Technology (NIST) as a highly secure encryption (see, for example, Non-Patent Document 1).

  AES is known to be highly secure. On the other hand, when compared with DES, which is an old US standard cipher, the disadvantage is that both the encryption device and the decryption device must be configured.

  When both the encryption device and the decryption device are realized only by the encryption device, the most frequently used method is to configure an encryption device using the Feistel structure. Since DES, which is an old US standard cipher, has a Feistel structure, it is obvious that an encryption device and a decryption device can be shared. On the other hand, it is not self-evident that an AES type encryption device realizes sharing of an encryption device and a decryption device. Here, an encryption device capable of sharing an encryption device and a decryption device is specified as an encryption device having a circuit sharing function.

  ANUBIS is known as an AES type encryption device that has a circuit sharing function, for example (see Non-Patent Document 2). The ANUBIS round function is composed of four functions in the same way as the AES round function, but each function is different from that of AES.

  SubBytes: Replaces the value of each cell with another value using an S-box with Involution.

  Transpose: Calculates the transpose of a 4x4 matrix.

  MixColumns: Stir each column of the 4 × 4 matrix with a stirring device that has involution.

  AddRoundKey: Exclusively ORs the subkeys expressed in a 4x4 matrix.

  Here, the Involution property means the property of returning to the original value as a result of executing the function twice. The reason that ANUBIS has the Involution property is because SubBytes, Transpose, and MixColumns all have the Involution property. ANUBIS is also known to be as secure as AES against prominent attacks such as differential cryptanalysis and linear cryptanalysis.

  The following shows the detailed conversion of AES ShiftRows and ANUBIS Transpose.

  Transpose has Involution, whereas ShiftRows does not have Involution. ShiftRows, on the other hand, is superior to Transpose in terms of implementation performance. Many implementations store 32 bits per column in one register and 128 bits using 4 registers. At this time, since the conversion of ShiftRows is closed in each row, ShiftRows can be implemented without using a shift command. On the other hand, it is necessary to use shift instructions to implement Transpose. For this reason, ANUBIS has a greater processing burden than AES.

“Announcing the ADVANCED ENCRYPTION STANDARD (AES)”, Federal Information Processing Standards Publication 197, November 26, 2001 Paulo S. L. M. Barreto and Vincent Rijmen, “The ANUBIS Block Cipher”, submitted to NESSIE Projecct

As described above, AES does not have a circuit sharing function. In addition, ANUBIS has a larger processing burden than AES. A first calculation unit that performs a calculation of a SubBytes function for replacing each element of the matrix using a predetermined replacement table having involution properties with respect to the input 4-by-4 matrix;
With respect to the calculation result of the first calculation unit, a second calculation unit that calculates a SwapRows function that converts SwapRows defined by the following equation;

A third calculation unit for calculating a MixColumns function for multiplying a calculation result of the second calculation unit by a predetermined agitation matrix of 4 rows and 4 columns having involution properties;
A fourth calculation unit for calculating an AddRoundKey function for calculating exclusive logic with a predetermined subkey matrix of 4 rows and 4 columns with respect to the calculation result of the third calculation unit;
Round function calculator including

  An object of the present invention is to provide a round function calculation device and encryption device having a circuit sharing function and a processing load smaller than that of ANUBIS, methods and programs thereof.

  A round function calculation apparatus according to an aspect of the present invention calculates a SubBytes function for replacing each element of a matrix with a predetermined replacement table having involution properties with respect to an input 4 × 4 matrix. A calculation unit, and a calculation result of the first calculation unit, a second calculation unit that calculates a SwapRows function that converts SwapRows defined by the following equation:

With respect to the calculation result of the second calculation unit, the third calculation unit that performs the calculation of the MixColumns function that multiplies the predetermined agitation matrix of 4 rows and 4 columns having the involution property, A fourth calculation unit that calculates an AddRoundKey function that calculates exclusive logic with a predetermined subkey matrix of 4 rows and 4 columns.

  An encryption apparatus according to an aspect of the present invention includes the round function calculation apparatus.

  It has a circuit sharing function and the processing load is smaller than ANUBIS.

The functional block diagram of the example of a round function calculation apparatus. The flowchart which shows the example of a process of a round function calculation method. The functional block diagram which shows the example of an encryption apparatus.

  Hereinafter, embodiments of the present invention will be described.

  This embodiment is based on ANUBIS, but uses SwapRows defined by the following equation instead of Transpose.

  SwapRows has an Involution property like Transpose. Therefore, even if SwapRows is used instead of Transpose, the circuit sharing function is maintained. Furthermore, as with ShiftRows, each transformation is closed in each row, so you can implement SwapRows without using shift instructions. For this reason, the processing burden is smaller than that of ANUBIS.

  In order for AES and ANUBIS to maintain high security against differential cryptanalysis and linear cryptanalysis, all four values in each column must be moved to different columns by ShiftRows and Transpose. This feature can be satisfied with SwapRows as well, so even if you use SwapRows instead of ShiftRows or Transpose, you can maintain high security.

[Round function calculation device and method]
As shown in FIG. 1, the round function calculation device includes, for example, a first calculation unit 1, a second calculation unit 2, a third calculation unit 3, and a fourth calculation unit 4. Each part of the round function calculation device performs the processing from step S1 to step S4 illustrated in FIG. 2 to realize the round function calculation method.

<First calculation unit 1>
The first calculation unit 1 calculates a SubBytes function for replacing each element of the matrix by using a predetermined replacement table having involution properties for the input 4 × 4 matrix (step S1). The calculation result is output to the second calculation unit 2.

  The input 4 × 4 matrix depends on the block encryption method and encryption method used by the round function calculation device.

  The predetermined substitution table may be any predetermined substitution table having involution properties. For example, it is possible to use an S-box substitution table having the involution property used in ANUBIS.

  The involution property means the property of returning to the original value as a result of executing the function twice.

  An example of the SubBytes function is the SubBytes function used in ANUBIS.

<Second calculation unit 2>
The second calculation unit 2 calculates the SwapRows function for converting the SwapRows defined by the following equation with respect to the calculation result of the first calculation unit 1 (step S2). The calculation result is output to the third calculation unit 3.

<Third calculation part 3>
The third calculation unit 3 calculates a MixColumns function that multiplies the calculation result of the second calculation unit 2 by a predetermined agitation matrix of 4 rows and 4 columns having involution properties (step S3). The calculation result is output to the fourth calculation unit 4.

  The predetermined agitation matrix may be any as long as the agitation matrix has involution properties.

  An example of the MixColumns function is the MixColumns function used in ANUBIS.

<4th calculation part 4>
The fourth calculation unit 4 calculates an AddRoundKey function for calculating exclusive logic with a predetermined subkey matrix of 4 rows and 4 columns with respect to the calculation result of the third calculation unit 3 (step S4).

  The predetermined subkey matrix of 4 rows and 4 columns depends on the block encryption method and encryption method in which the round function calculation device is used.

  An example of the AddRoundKey function is the AddRoundKey function used in ANUBIS.

[Encryption device and method]
The encryption device and method include a round function calculation device and method, respectively, for example, as shown in FIG. The encryption apparatus and method execute encryption or decryption of data by repeatedly executing round function calculation by the round function calculation apparatus and method a plurality of times.

  Details of the encryption device and method depend on the encryption method to be implemented. For example, a block encryption method using a round function similar to ANUBIS can be used.

  Since each function constituting the round function has the Involution property, the round function also has the Involution property. Therefore, the encryption apparatus and method using the round function have a circuit sharing function and can be used for both encryption and decryption.

[Modifications, etc.]
The processes described in the above apparatus and method are not only executed in time series according to the description order, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the process.

  Various processing functions in each of the above devices may be realized by a computer. In that case, the processing contents of the functions that each device should have are described by a program. Then, by executing this program on a computer, various processing functions in each of the above devices are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Further, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its storage unit. When executing the process, this computer reads the program stored in its own storage unit and executes the process according to the read program. As another embodiment of this program, a computer may read a program directly from a portable recording medium and execute processing according to the program. Further, each time a program is transferred from the server computer to the computer, processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program includes information provided for processing by the electronic computer and equivalent to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In addition, although each device is configured by executing a predetermined program on a computer, at least a part of these processing contents may be realized by hardware.

Claims (5)

A first calculation unit that performs a calculation of a SubBytes function for replacing each element of the matrix using a predetermined replacement table having involution properties with respect to the input 4-by-4 matrix;
With respect to the calculation result of the first calculation unit, a second calculation unit that calculates a SwapRows function that converts SwapRows defined by the following equation;

A third calculation unit for calculating a MixColumns function for multiplying a calculation result of the second calculation unit by a predetermined agitation matrix of 4 rows and 4 columns having involution properties;
A fourth calculation unit for calculating an AddRoundKey function for calculating exclusive logic with a predetermined subkey matrix of 4 rows and 4 columns with respect to the calculation result of the third calculation unit;
Round function calculator including   A cryptographic device including the round function calculation device according to claim 1. A first calculation step in which a first calculation unit calculates a SubBytes function for replacing each element of the matrix by using a predetermined replacement table having an involution property with respect to the input 4 × 4 matrix;
A second calculation unit performs a calculation of a SwapRows function for converting SwapRows defined by the following equation for the calculation result of the first calculation unit:

A third calculation step in which a third calculation unit calculates a MixColumns function that multiplies the calculation result of the second calculation unit by a predetermined agitation matrix of 4 rows and 4 columns having involution properties;
A fourth calculation step in which a fourth calculation unit calculates an AddRoundKey function for calculating exclusive logic with a predetermined subkey matrix of 4 rows and 4 columns with respect to the calculation result of the third calculation unit;
Round function calculation method including   An encryption method including the round function calculation method according to claim 3.   A program for causing a computer to function as each part of the round function calculation device according to claim 1 or the encryption device according to claim 2.

Images